🚨Danfoss SM-800A Controllers Hit by Pre-Auth RCE Zero-Days Found in an Hour

Your fridge controllers might be wide open right now

Danfoss SM-800A industrial controllers have multiple pre-authentication remote code execution zero-days, and a public proof-of-concept already exists. A Midnight Blue researcher found them in about an hour of manual digging on the latest firmware, version 5.3.2. The bugs are stack-based buffer overflows, so an attacker doesn't need credentials to take over the device. If you run these controllers, or anything in the AK-SM800, AK-SM800A, or AK-EM100 lines, treat this as an incident in progress. The impact includes full device takeover, persistent access, and persistent denial of service. That's bad news for anyone running refrigeration or building automation on this hardware, because the box sits on your network and talks to your systems. The numbers are ugly. As of October 11th, 2026, hundreds of Danfoss systems were still reachable from the internet, and over 1000 Copeland and Dixell fridge controllers were exposed too. Firmware images are publicly downloadable from Danfoss, so attackers can reverse them just like the researchers did. Danfoss's mitigation is to restrict exposure with VPNs, private APNs, or tight IP allowlists.